Supported Features
-
VoiceOver
-
Dark Interface
-
Sufficient Contrast
pcapLume
Defensible packet forensics
Only for Mac
Free · In‑App Purchases
Mac
Files carved and hashed. Beacons caught by their timing. Cleartext credentials surfaced. Analysed on your Mac; every report states what was read and what was not.
Your capture is your client's traffic; uploading it to a web analyser can breach an engagement letter. pcapLume reads Ethernet .pcap and .pcapng on your Mac.
WHAT IT READS
Ethernet II only (DLT_EN10MB); any other link layer is declined at ingest, by name. Only IPv4 is decoded; IPv6 and VLAN-tagged frames are counted, not decoded. Up to 1,000,000 packets are read from a file. Reading close to 1,000,000 packets can need more than 14 GB of memory. The Integrity Record prints that cap and how the read ended: end of file, an error, or the cap. These limits apply in both tiers.
FREE AND PRO
Free opens a capture and runs the whole analysis. You see a findings summary as counts (nothing found shows only the packet count), the first 25 packets and flows in the inspector with every header field and the decoded payload, plus Settings, Zero Telemetry and the manual. Free is a sample, not a working tool.
Pro is everything you take away or put before a client: all seven PDF reports, CSV export, threat details, carved files, the full packet and flow lists, the six locked Intelligence Dashboard panels, and Shodan, Censys and geolocation enrichment.
INTEGRITY RECORD (CAPTURE FILE)
One examination event, documented: the evidence file with its MD5, SHA-1 and SHA-256, when it was read and by whom, the analysed subset with its own SHA-256, how it was read, and the hosts pcapLume's own requests went to. It states exactly what was examined, or says plainly that it could not. It also states that pcapLume did not acquire the file and does not know who captured it, or under what authority.
CHAIN OF CUSTODY LOG
A separate hash-chained ledger. Every entry is marked observed by the software or asserted by a person. An entry altered, removed or reordered is detected and named; truncation is caught by a separately kept count. Neither check uses a secret, so neither holds against someone with full write access to this Mac. The chain is append-only: a correction is a further entry. The printed log carries the entries, the verdict and a signature line.
WHAT IT FINDS
- Hex and ASCII over a reassembled stream's first 50 KB, plus each packet's decoded payload.
- Files carved from unencrypted HTTP over TCP (EXE, ZIP, JPEG, PDF, HTML), SHA-256 hashed when complete.
- Periodic beaconing by timing regularity, high-entropy payloads, five fixed signatures, IoT heuristics.
- Cleartext on TCP ports 80, 21 and 23 only: credentials, emails, phone numbers, URLs, US Social Security numbers, and cards passing Luhn with a recognised issuer prefix.
- TLS is never decrypted; the server name is read from the unencrypted handshake.
WHAT IT DOES NOT DO
There is no rule language. A carved file's checksum is an integrity value, not proof of handling — though exporting one writes a custody entry naming it. The MAC-to-vendor table is empty until you fetch the IEEE list.
ZERO TELEMETRY
Off unless you turn it on, in Guided Setup or in Settings. Left off, with Pro, pcapLume automatically looks up the country beside each public top talker on geojs.io. Anything that needs your own key runs only after you add that key. Shodan, Censys and AlienVault OTX need your own keys and run only when you ask; abuse.ch feeds and the IEEE vendor list download only when you press Sync. Turned on, pcapLume makes no outside call of its own. Either way, Apple's StoreKit is contacted for prices and licences, and an IP shown as a link opens whois.domaintools.com in your browser. Settings names every host and what triggers it.
PRICING
Pro is a yearly auto-renewing subscription (USD 199.99) or a one-time lifetime purchase (USD 999.99). Prices vary by region. No trial; the free tier does not expire. Charged to your Apple Account. Renews unless cancelled at least 24 hours before the period ends; manage it in Apple Account settings.
Privacy Policy: https://profworkbench.com/#privacy
Terms of Use: https://profworkbench.com/#terms
For examiners who sign their name to what the tool says. ProfWorkBench, LLC.
Ratings & Reviews
- This app hasn’t received enough ratings or reviews to display an overview.
27.0 CHANGES THE FREE TIER. Please read this before updating.
Free no longer produces reports or exports. Before 27.0, the free tier could generate and export PDF reports; from 27.0, every report and every export (all seven PDFs, CSV, and the .plume workspace), threat details, carved-file access, the full packet and flow lists, the six locked Intelligence Dashboard panels and enrichment require Pro. Free still opens a capture, runs the whole analysis on it, shows a findings summary as counts, and gives you the first 25 packets and flows in the inspector, with every header field and the decoded payload; finding names and live OSINT lookups stay Pro. If you relied on free reports, this release removes them; reports you exported before updating are files on your disk and are unaffected. Pro subscribers and lifetime owners lose nothing.
NEW: INTEGRITY RECORD (CAPTURE FILE)
The document formerly titled "Chain of Custody Certificate" contained only file hashes. It is now called the Integrity Record. It now records the analysed subset with its own SHA-256, how the file was read, whether the read reached the end of the file, and the hosts the app's own recorder logged during the session.
NEW: CHAIN OF CUSTODY LOG
A real, hash-chained custody ledger. Every entry is marked observed-by-software or asserted-by-a-person, corrections are appended rather than edited in, and a break within the chain is named in the report.
ALSO
- Shodan and Censys API keys now live in the macOS Keychain.
- Settings lists every host the app can contact when Zero Telemetry is off, and what each is used for.
- Localised into 15 languages.
- Carved files now get a SHA-256 fingerprint only when pcapLume has rebuilt the whole file; any file it could not rebuild completely is clearly marked incomplete.
CORRECTED LISTING
The previous listing described a rule-based scanner, sample captures, an offline vendor table and an import purchase. pcapLume has five fixed payload signatures, ships no sample captures, ships its MAC vendor table empty, and has never gated import. Two limits that were never stated are now stated: pcapLume decodes Ethernet II captures only and declines any other link layer at ingest, and it reads up to 1,000,000 packets from a file. The packet cap is not new. The Ethernet II limit was always true of the decoder, but 27.0 is the first release that detects another link layer and declines the file by name instead of parsing it as if it were Ethernet. Neither differs between the free and Pro tiers. This listing describes the build you are installing.
The developer, ProfWorkBench, LLC, indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .
Data Not Collected
The developer does not collect any data from this app.
The developer indicated that this app supports the following accessibility features. Learn More
For more information, visit the developer’s accessibility website .
Information
- Seller
- ProfWorkBench, LLC
- Size
- 5.3 MB
- Category
- Developer Tools
- Compatibility
Requires macOS 14.0 or later.
- Mac
Requires macOS 14.0 or later.
- Mac
- Languages
English and 14 more
- English, Arabic, French, German, Hebrew, Hindi, Italian, Japanese, Korean, Portuguese, Russian, Simplified Chinese, Spanish, Traditional Chinese, Turkish
- Age Rating
4+
- 4+
- In-App Purchases
Yes
- Pro (Annual) $199.99
- Genesis Partner License $999.99
- Copyright
- © 2026 ProfWorkBench, LLC